If "any code can be broken," then the the government wouldn't spend so much time trying to legally force you to incriminate yourself by making you hand over your passwords and encryption keys. They would simply decrypt your files without even bothering to contact you.

1. Working behind the scenes to keep the public encryption standards just weak enough that they can break them if they want to.2. Building back-doors into a lot of popular software.3. Working on things like keyloggers and other ways to pull the data off targeted devices without having to break the encryption.4. Working tirelessly on new decryption algorithms, and specialized supercomputers to run them effectively.

I have no skeletons in my closet. None. No amount of peeking into my Facebook or Gmail account is going to yield blackmail-able information about me, because nothing of the kind exists. I am an honest-to-God upstanding citizen. I don't drink and drive. I've never been arrested. I've never attended a protest. I don't have any porn of any type on my computer. I've never cheated on anyone. I vote in every election. And so on and so forth...

What bothers me is that the NSA (or whoever) may need a scapegoat for something down the road, and I might just be too convenient for that purpose, in which case they would have to LIE and invent "evidence" in order to make such an accusation stick, which may include information that they claim they got through NSA surveillance (but wouldn't be able to disclose exactly how, since that information needs to be kept confidential for national security purposes). In which case it doesn't matter what my "rights" are; I will have no protections whatsoever.

smerfnablin:Can you imagine how many peda bytes of porn the NSA collects daily?!

The only thing I have ever seen consistently encrypted had been things guys don't want their girlfriends to know about...

The NSA probably does have one of the largest databases of porn files in the world.

Though it is probably orders of magnitude smaller than the amount of porn in the internets.

When the NSA comes across a big encrypted file maybe it IS ultra-top-secret plans for the new KeyHole-666 spy satellite or maybe it's just another porn file. If they automatically decrypt it and can match it against the porn DB then it is no big deal and goes into their records as just evidence that a particular citizen likes porn. If they can't match it against something known then it requires further attention - maybe using some secret heuristic classifier or having an actual human look at it.

Having enormous DBs of porn, music, movies, and other things that copies of commonly float around the internets is an easy way of weeding out things that don't need attention.

It's cute that you're assuming that this is what subby is thinking. Of course it's a /computer/ reading your farking mail (and your phone, and your skype, and your usenet, and your irc, and your gopher, and your sftp, and anything else that goes down the fiber) and cataloging it and filed away to be used against you in the future, should you become a threat to the powers that be. So they can go back 20 years to find stuff to use against you.

If "any code can be broken," then the the government wouldn't spend so much time trying to legally force you to incriminate yourself by making you hand over your passwords and encryption keys. They would simply decrypt your files without even bothering to contact you.

1. Working behind the scenes to keep the public encryption standards just weak enough that they can break them if they want to.2. Building back-doors into a lot of popular software.3. Working on things like keyloggers and other ways to pull the data off targeted devices without having to break the encryption.4. Working tirelessly on new decryption algorithms, and specialized supercomputers to run them effectively.

Yes and even with all that, it gives them your CC number.

Were there people stupid enough to think that SSL HTTPS was a secure standard? Despite the numerous times it's been shown to be either completely broken, or partially broken? Or the fact that you can simply MitM the server? SSL was designed to be secure against casual snooping, it was never designed to be secure for more than a few hours in any case.

There is an old thought process about encryption. It goes roughly like this... How valuable is the material? How time sensitive is it? Now pick an algorithm that exceeds both those values.

Because the bottom line has always been that nearly any encryption can be broken, you just need it to hold long enough to get past the useful time frame of the information. It's long been thought that SSL was good enough for it's use because criminal elements don't have the computer power required to crack it quickly (or at all), but that is utter fantasy land bullshiat. Distributed systems like botnets can crack through SSL like a hot knife through butter, and SETI and other similar programs proved that ages ago.

This isn't theoretical, this is shiat I've dealt with in the real world. There is commercially available software that will break SSL by brute-force if you have a large enough botnet/system/MPP, and there are commercially available software for all of that too.And that's the stuff the "hackers" have. Imagine what the government agencies that have been at this for 60 years, and a couple trillion dollars, AND "national security" have going for them.

Current internet communications aren't secure, they never were, but for some reason a lot of people seem to think they are now, and that's just plain wrong.

Kahabut:One time pads are by far the MOST secure system I know of, but they can hypothetically still be brute forced. It's just that the entropy inherent in that particular system is rather absurdly high. Doesn't mean you won't get lucky though, it just makes it a lot less likely. (absurdly less likely) I'm just being realistic though, nothing is unbreakable. NOTHING. OTPs are pretty close though.

Actually, no.

You can brute force an OTP, but in the end all you will be doing is making a list of every possible message the same length, with no way to know which is which.

Lets say you intercept an 8 character message. You can brute force that fairly quickly, because there are only 208,827,064,576 possibilities, and if you can check a million per second, it would only take you about 2.4 days to run through them all. The vast majority will be nonsense, but you can use a computer to winnow out the possibilities to those that contain actual English.

That's the easy part.

Does the 8 character message say "ILOVEYOU" or "IHATEYOU" or "KILLJEFF" or "SAVEJEFF" or "DUCKTALE" or "EATWORMS" or any other valid English word, phrase, or combination thereof?

You've got no way to know, so security is preserved even if you manage to brute force the solution, because there is no way for you to know when you have the correct solution.

dittybopper:Pointy Tail of Satan: Whats actually bad about this, is that they cannot admit or use evidence from hacking, or they would be exposing their methods and capabilities. So what can they do? Generate false evidence? Use blackmail and extortion? Or in the case of outside the country, simply wack someone? There is a good reason why star chambers are forbidden in most countries.

Actually, what they do is they have a special law enforcement unit of the DEA called the "Special Operations Division" that takes that information from agencies like the NSA and feeds it to law enforcement. It's like an "anonymous tip", but not really, because the ultimate source of the tip is an unconstitutional search:

The unit of the DEA that distributes the information is called the Special Operations Division, or SOD. Two dozen partner agencies comprise the unit, including the FBI, CIA, NSA, Internal Revenue Service and the Department of Homeland Security. It was created in 1994 to combat Latin American drug cartels and has grown from several dozen employees to several hundred.

Today, much of the SOD's work is classified, and officials asked that its precise location in Virginia not be revealed. The documents reviewed by Reuters are marked "Law Enforcement Sensitive," a government categorization that is meant to keep them confidential.

"Remember that the utilization of SOD cannot be revealed or discussed in any investigative function," a document presented to agents reads. The document specifically directs agents to omit the SOD's involvement from investigative reports, affidavits, discussions with prosecutors and courtroom testimony. Agents are instructed to then use "normal investigative techniques to recreate the information provided by SOD."

A spokesman with the Department of Justice, which oversees the DEA, declined to comment.

But two senior DEA officials defended the program, and said trying to "recreate" an investigative trail is not only legal but a technique that is used almost daily.

A former federal agent in the northeastern United States who received such tips from SOD described the process. "You'd be told only, 'Be at a certain truck stop at a certain time and look for a certain vehicle.' And so we'd alert the state police to find an excuse to stop that vehicle, and then have a drug dog search it," the agent said.

/Keep your plaintext and keys off of electronic devices.//Pencil and paper FTW.

And the one other person that you speak to is very happy that your messages are encrypted.

Well, think about that for a minute: How many people do you actually talk important stuff with?

Right now, I have probably 2 to 4 at most: My wife, my father, and perhaps a couple of other people. I generally talk about stuff in person with the distaffbopper, so there is no need to encrypt there. Same with my father.

I'd have to generate pads for each, which for a low number of correspondents isn't that big a deal, and it has the advantage/disadvantage that what I say to Bob isn't readable by Charlie.

But if I had a larger number of correspondents, I'd generate a fairly limited number of one time pads, and I would use them to transmit the strip alphabets and keying orders for strip ciphers.

A strip cipher, similar to this one I made a while back:

is very secure if you use a fraction of large number of strips (say, 90 total strips, and you only use 30 on any given day) and you keep the amount of traffic fairly low. The Germans were able to break the US M-138 strip cipher occasionally during WWII, but that was due to the very large amount of traffic being sent in it, and the longevity of the strip alphabets.

Strip ciphers are especially secure because you never need to write down the plaintext, not during encryption or decryption, unless you want to.

You would generate the strip alphabets by pulling scrabble tiles out of a bag (bag contains 1 of each letter). You number the strips 01 to 99, and to generate the keying document for a month, you roll 2 10-sided dice to generate the strip order, obviously skipping repeats. So a simplified version for a single day, using only 20 strips, would look something like this:

SEPT 06: 01 23 67 92 43 87 22 59 11 07 69 57 88 04 55 15 66 22 86 13

It took me all of 2 minutes to generate that key, using 2 dice, and it would be good for an entire day, or, if your traffic is pretty light, maybe you could stretch that to a week.

Any particular set of strips would only be good for a limited amount of time, say, a month, or perhaps, at most, 6 months if you rarely communicate.

When you generate a new set of strips and new keying documents, you encrypt them in the one time pads, and then transmit them to your correspondents, or, if possible, simply transfer them physically to cut down on the amount you transmit.

It's not unbreakable, of course, but nothing short of properly implemented one time pads are unbreakable, and given large numbers of strips, of which only a fraction are used for any given key period, and a short strip life, I would be surprised if it could be broken cryptanalytically without physical access to the strips.

I guess it is time for Congress to deliver on what must have been a promise by the agencies of another grant of immunity from lawsuits in favor of the companies that cooperated, to the extent they are not covered by the original one. And it may also have to immunize individual agents who acted for the government when the individual's employer was not cooperating, if there were any such cases, because the employer would have a claim against the employee.

Over in the TSA thread 4ts came out with some derp about how the US government is going to try to incentive people to adopt a government verified online identity, that would confer some benefit in return for which the user waives any right not to be tracked, the way many do in employment agreements. I suspect they see a future in which the norm would be for people to authenticate for all communications, all platforms.

But my question is WHY would the NSA be reading my communications, encrypted or in the clear?

Do they have time to detail someone to comb through my Facebook posts to my friends about our views on someone's difficulties with her boyfriend? Or another one's cat's antics?

IF I was doing anything wrong or illegal, guess what. None of it would be via computer anyway, and very likely not even by phone. It would be so far off the grid that the NSA wouldn't even know where to look for it--like the Unabomber did.

If "any code can be broken," then the the government wouldn't spend so much time trying to legally force you to incriminate yourself by making you hand over your passwords and encryption keys. They would simply decrypt your files without even bothering to contact you.

This is because it's virtually impossible to correctly implement them by computer, and because most people think in terms of "must be able to send gigabytes of data every day", then yeah, it becomes inconvenient. And distributing keys (the pads) is an issue for that amount.

But for short, infrequent, but *IMPORTANT* messages, OTPs can't be beat, security-wise. That's why they are still used to communicate with agents in foreign countries, via numbers stations: Anyone can monitor short wave stations, and the ability to add and subtract is really all you need to encode or decode a message, given the key.

The added bonus of not using a computer that might be vulnerable just enhances the security.

TheOnion:Until someone figures out how to quickly factor large prime numbers, modern public key encryption is effectively unbreakable. It's possible that the NSA has that kind of technology, but if they are withholding it they are holding back an incredibly important advancement in both mathematics and humanity. Which is probably the kind of thing they'd do

Just read this, was great http://www.amazon.com/The-Code-Book-Break-Crack/dp/0385729138/ref=sr_ 1 _4?ie=UTF8&qid=1378428556&sr=8-4&keywords=the+code+book

Kinda off topic, but if you want a good read about computer security from back in the day, check out The Cuckoo's Egg. I just finished it a couple days ago, and would highly recommend it.

Pointy Tail of Satan:Whats actually bad about this, is that they cannot admit or use evidence from hacking, or they would be exposing their methods and capabilities. So what can they do? Generate false evidence? Use blackmail and extortion? Or in the case of outside the country, simply wack someone? There is a good reason why star chambers are forbidden in most countries.

The unit of the DEA that distributes the information is called the Special Operations Division, or SOD. Two dozen partner agencies comprise the unit, including the FBI, CIA, NSA, Internal Revenue Service and the Department of Homeland Security. It was created in 1994 to combat Latin American drug cartels and has grown from several dozen employees to several hundred.

Today, much of the SOD's work is classified, and officials asked that its precise location in Virginia not be revealed. The documents reviewed by Reuters are marked "Law Enforcement Sensitive," a government categorization that is meant to keep them confidential.

"Remember that the utilization of SOD cannot be revealed or discussed in any investigative function," a document presented to agents reads. The document specifically directs agents to omit the SOD's involvement from investigative reports, affidavits, discussions with prosecutors and courtroom testimony. Agents are instructed to then use "normal investigative techniques to recreate the information provided by SOD."

A spokesman with the Department of Justice, which oversees the DEA, declined to comment.

But two senior DEA officials defended the program, and said trying to "recreate" an investigative trail is not only legal but a technique that is used almost daily.

A former federal agent in the northeastern United States who received such tips from SOD described the process. "You'd be told only, 'Be at a certain truck stop at a certain time and look for a certain vehicle.' And so we'd alert the state police to find an excuse to stop that vehicle, and then have a drug dog search it," the agent said.

I don't think anyone is reading it... I think they are storing it... and I think that storage presents a huge risk for abuse. Aside from that, the court has ruled that unauthorized copying of electronic data, to include communications, not just intellectual property, constitutes "taking" and theft in a criminal sense, given that it is law enforcement doing the taking, it falls under the auspices of "seizure," which is lawful only when done with a duly issued warrant. Given that the fourth amendment to the constitution is explicitly clear about the need for specificity("particularly describing the place to be searched, and the persons or things to be seized") , I cannot fathom how a warrant could be duly issued such that it particularly describes every person from whom email is being seized, and establishes anything resembling probable cause to suspect said persons.

That said, I don't believe them. If they were that good at decrypting things with any efficiency, they wouldn't be before the courts in GB saying that Greenwald's partner had those thousands and thousands of documents, but they couldn't tell what they were. Ceteris Paribus, and given their tenuous history with the truth, I would chalk this bit of "news" up to counter-intelligence more than I would a leak or serious issue with security of well-encrypted communications.

As a security side note, encrypting your communications does not mean sending email via some service that claims to be secure or encrypted. Securing your communications means encrypting it your darned self, using key(s) (defined to include typed, photographic, biometric, and other keys) that only you and the recipient will have access to. In a more ideal world, direct transfers via physical mediums are superior. Though your email is of dubious status with regards to the need for a specific warrant for you, your mail is not... if someone wants to open an actual article or package sent through the mail, they'll still be able to do it, but they'll need to go to an actual judge (not just one of the FISA rubber stamps), and articulate a reason for going through your stuff. If the information you are sending is *so* sensitive that you're actually worried about emailing it, that'd probably be the way to go.

/it's gonna be a clusterfark when someone cracks the NSAs database and pretty much everyone's personal stuff is all of a sudden very very public, beyond the clear potential for massive fraud/identity theft, there is no such thing as a perfectly secure system, and our government has not demonstrated anywhere near the level of competence necessary for me to believe that they could adequately hold and secure that information in perpetuity.

If "any code can be broken," then the the government wouldn't spend so much time trying to legally force you to incriminate yourself by making you hand over your passwords and encryption keys. They would simply decrypt your files without even bothering to contact you.

Because the NSA doesn't care about the run of the mill pedo or small time meth dealer and they aren't going to show what they can do just so John Law can look good in the local papers

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized

1. Reasonable to search everything for everybody?2. What is the probable cause for searching everything?3. What is the target of the warrant to search?

Sure it does. Did they catch him because of de-crypted emails, reams of documents, sekrit files full of phone messages and all kinds of other stuff people are worried about? No. They caught him the hard way, by releasing his "manifesto" which is brother happened to see, and recognized the style. Which led to his remote cabin that was full of other, usable evidence--bomb making materials similar to other bombs the Unabomber had sent, the typewriter used to type the "manifesto" and other things that would have convinced a jury (if he had gone to trial) in no uncertain terms, that this was the guy who'd been blowing people up for the past 25 years.

Which is the other issue: In a country that still nominally runs by rule of law, you get a fair trial. All this crap the NSA is sekritly compiling to theoretically make you look bad if someday they need to scapegoat you because for some reason or other--assuming they did, you still go to trial in open court, unless you're being court-martialed. And juries are still oddly reluctant to convict based on strange evidence they don't really understand, gotten in ways they can't comprehend by agencies they don't particularly like--which is why OJ and Casey Anthony got away with it. (DNA? What's DNA? how does that work? Why can't they just talk about how Nicole was murdered?)

Unless by now you're so paranoid you think you're going to be tried in secret by a rigged jury and not given your choice of attorney--in which case why does the evidence against you matter anyway?--then this fear of what the NSA is doing is misplaced. The fears should not be what they're doing, but how to prevent use of whatever they're getting from being used once they've got it; because they're going to get it regardless.

If "any code can be broken," then the the government wouldn't spend so much time trying to legally force you to incriminate yourself by making you hand over your passwords and encryption keys. They would simply decrypt your files without even bothering to contact you.

Because the NSA doesn't care about the run of the mill pedo or small time meth dealer and they aren't going to show what they can do just so John Law can look good in the local papers

BullBearMS: "Everybody's a target; everybody with communication is a target."

The documents excerpted in the Guardian version actually talk about the cryptanalytic efforts as being directed at "civilians and other adversaries". It's a war on you and your privacy. And as if to drive the point home, the US and UK agencies each named their version of the operation after a civil war battle from the histories of their respective countries.

TheOnion:Until someone figures out how to quickly factor large prime numbers, modern public key encryption is effectively unbreakable. It's possible that the NSA has that kind of technology, but if they are withholding it they are holding back an incredibly important advancement in both mathematics and humanity. Which is probably the kind of thing they'd do

Just read this, was great http://www.amazon.com/The-Code-Book-Break-Crack/dp/0385729138/ref=sr_ 1 _4?ie=UTF8&qid=1378428556&sr=8-4&keywords=the+code+book

NSA is the largest private employer of mathematics PhD's in the country. They have their own engineers to build their supercomputers since no one makes the technology they need. Rumor has it that it took less than 30 minutes for them to break the internet 128 bit encryption just by using brute force.

dittybopper:1. Working behind the scenes to keep the public encryption standards just weak enough that they can break them if they want to.2. Building back-doors into a lot of popular software.3. Working on things like keyloggers and other ways to pull the data off targeted devices without having to break the encryption.4. Working tirelessly on new decryption algorithms, and specialized supercomputers to run them effectively.

I'm okay with #3 and #4; that's in line with their mandate. It's #1 and #2 where I draw the line. NSA's other mandate used to be to secure the communications of US persons, both meat-based and corporate. It took NSA 10-15 years to get over the stigma of the rumors that they farked with the S-boxes to put a back door in DES, before the community finally realized they'd been trying, as hard and as quietly as they could, to help.

Today I learned that the tinfoil hats of the 80s weren't wrong, they were just a few decades ahead of their time. How well can any business trust the AES-NI instruction set in that spiffy CPU of theirs?

bubo_sibiricus:Your Average Witty Fark User: NO ONE IS READING YOUR FARKING EMAIL

It's cute that you're assuming that this is what subby is thinking. Of course it's a /computer/ reading your farking mail (and your phone, and your skype, and your usenet, and your irc, and your gopher, and your sftp, and anything else that goes down the fiber) and cataloging it and filed away to be used against you in the future, should you become a threat to the powers that be. So they can go back 20 years to find stuff to use against you.

That's why this is being done.

That right there. If you ever become worthy of destroying, they can easily do that.

If "any code can be broken," then the the government wouldn't spend so much time trying to legally force you to incriminate yourself by making you hand over your passwords and encryption keys. They would simply decrypt your files without even bothering to contact you.

Sure they would. It's a win-win for them. If you cooperate, they weren't evil people who spied on you - you gave them the key. If you don't cooperate, they have one more reason to throw you in prison.

We never dealt with domestic. With us, it was always war. We won the war. Now we're fighting the peace. It's a lot more volatile. Now we've got ten million crackpots out there with sniper scopes, sarin gas and C-4. Ten-year-olds go on the Net, downloading encryption we can barely break, not to mention instructions on how to make a low-yield nuclear device. Privacy's been dead for years because we can't risk it. The only privacy that's left is the inside of your head. Maybe that's enough. You think we're the enemy of democracy, you and I?

TheOnion:Until someone figures out how to quickly factor large prime numbers, modern public key encryption is effectively unbreakable. It's possible that the NSA has that kind of technology, but if they are withholding it they are holding back an incredibly important advancement in both mathematics and humanity. Which is probably the kind of thing they'd do

Gyrfalcon:But my question is WHY would the NSA be reading my communications, encrypted or in the clear?

Do they have time to detail someone to comb through my Facebook posts to my friends about our views on someone's difficulties with her boyfriend? Or another one's cat's antics?

IF I was doing anything wrong or illegal, guess what. None of it would be via computer anyway, and very likely not even by phone. It would be so far off the grid that the NSA wouldn't even know where to look for it--like the Unabomber did.

I'm glad they use social security numbers instead of punching holes in our ears.

Until someone figures out how to quickly factor large prime numbers, modern public key encryption is effectively unbreakable. It's possible that the NSA has that kind of technology, but if they are withholding it they are holding back an incredibly important advancement in both mathematics and humanity. Which is probably the kind of thing they'd do